Intel® Active Management Technology Developers Guide

Download PDF
ID 772055
Date 1/05/2021
Public
Document Table of Contents
Document Table of Contents x
Intel® Active Management Technology Developers Guide
Intel® Active Management Technology Developers Guide x
Getting Started with Intel® Active Management Technology Discovery Configuration Wi-Fi* Connections Remote Power Management KVM Storage Redirection Remote Secure Erase Object Missing User Consent
Getting Started with Intel® Active Management Technology x
Intel® AMT Basic Concepts Intel® Active Management Technology 11 Intel® Active Management Technology 10 Intel® Active Management Technology 9
Discovery x
Integrating Intel® AMT Discovery into a Management Console
Configuration x
Integrating Intel® AMT Configuration into a Management Console Intel® SCS Configuration Tools
Intel® SCS Configuration Tools x
Intel® AMT Configuration Utility
Intel® AMT Configuration Utility x
Profile Creation, file only Profile Creation, USB Key - Single Use Profile Creation, USB Key - Multi Use Host Based Configuration via OS
Profile Creation, file only x
Profile Creation, Delta Profiles
Wi-Fi* Connections x
Wireless Configuration Concepts Wireless Configuration Methods
Remote Power Management x
Integrating Intel® AMT Remote Power Management Solution into a Management Console Remote Power Management of Intel® AMT Devices with InstantGo
KVM x
Integrating KVM feature into a Management Console
Remote Secure Erase x
Implementing Remote Secure Erase Remote Secure Erase FAQ
Intel® Active Management Technology Developers Guide

Implementing Remote Secure Erase

Intel® Active Management Technology (Intel® AMT) version 11.0 introduces a new feature called Remote Secure Erase (RSE). RSE is designed to allow IT administrators to remotely wipe the hard disk of the client device supporting AMT (v11.0 or above).

When an employee leaves the organization, the IT administrator will collect the PC - erase the disk drive, reload the OS and applications as needed. Remote Secure Erase combined with other Intel® AMT redirection features (IDE-R, KVM) allows the IT administrator to securely erase the whole disk drive (bootable partition) and using KVM and IDE-R can provision OS and applications remotely.

Below are the platform requirements for RSE support:

  • Platform with Intel AMT 11.0 or later
  • BIOS supporting Intel RSE capability
  • Intel® SSD Professional Family (Pro 6000p Series, Pro 5400s Series, Pro 2500 Series, Pro 1500 Series, )

In order to add support for Intel RSE to your solution, you will need the and the Intel® AMT SDK Documentation and Implementation guide.

The following are the steps for implementing the Intel RSE solution:

  1. IT administrator sets user and master hard drive password on the PC before deploying it to the employee.
  2. System discovery – ISV to verify if the system supports the Intel RSE feature or not (AMT_BootCapabilities.SecureErase).
  3. Only for the systems supporting the Intel RSE feature, ISV application would provide an option to perform secure erase in their management console
  4. When initiating the secure erase operation, ISV console will prompt the IT administrator for the master password configured for the drive.
  5. ISV will use the IT administrator-provided master password to set boot options to secure erase and send password to AMT and reboot the platform.
  6. To check the progress of the erase operation, ISV queries AMT_BootSettingsData.BIOSLastStatus and expects to see the first element of status to report as InProgress. This indicates that remote secure erase operation has started. Erase operation time varies by the size of the disk being operated on.
  7. The first item of BIOSLastStatus would change to either 0 – success or 65535 – failed.
    1. If status changes to 0, BIOS automatically clears the boot options and ISV console can display a message for successful erase operation.
    2. If status changes to 65535, examine the second item of BIOSLastStatus to get the detailed error message. In case of failure, boot options are not cleared. So depending on the detailed error message, ISV console can either stop the operation or retry. If the boot operation stopped, boot options will need to be cleared through WS-Man command. For a retry attempt, depending on system power state, either power up or reset the platform to try the secure erase operation on the next boot.

The PowerShell* script (see attachments) demonstrates the usage of the Intel AMT RSE feature with code snippets. For information on running PowerShell scripts with the Intel® vPro™ technology module, please refer to the Intel® AMT SDK and related Intel® AMT Implementation and Reference uide.

After establishing a connection, the script demonstrates the flow as described above. (Note: you will need to enter the proper credentials and machine address for your client system.)

This should provide all the items you need to start using the feature. If you have questions, please post them to the Intel® Business Client Software Development Discussion Forum.

 

*No product or component can be absolutely secure.

Parent topic: Remote Secure Erase
Level Two Title